Shai-Hulud CHAINDROP wave

CHAINDROP — the Shai-Hulud npm worm returns through the keyv maintainer, backdoors 400+ packages, and resolves its exfiltration endpoint from an Ethereum smart contract

Elastic Security Labs identified a new Shai-Hulud campaign on 2026-08-04 that began by trojanising the monorepo of keyv, a widely used key-value storage library, and embedding a self-propagating worm it names CHAINDROP (Elastic Security Labs, 2026-08-06). Elastic reports over 400 unique npm packages compromised at the time of writing, and quantifies the blast radius through download volume: keyv alone received over 600 million downloads in the preceding month, with flat-cache near 580 million, cacheable-request over 137 million, cacheable over 30 million and cache-manager over 16 million (Elastic Security Labs, 2026-08-06). OX Security published its own first-hand analysis two days earlier and describes a massive Shai-Hulud campaign against npm on its own larger package and download counts (OX Security, 2026-08-04). Elastic frames the wave explicitly as the return of Shai-Hulud rather than a new family, and points to the Dune-derived naming the payload reuses as the similarity to previous Shai-Hulud campaigns (Elastic Security Labs, 2026-08-06).

Execution. The chain starts at a preinstall hook in package.json, abusing a legitimate npm feature that runs arbitrary commands before a package is installed and therefore needs no interaction from the victim beyond the install itself (Elastic Security Labs, 2026-08-06). Every subpackage in the keyv repository was backdoored with a dropper that checks whether the Bun JavaScript runtime is present and, if not, detects the host platform and architecture and downloads Bun directly from its official release page before using it to execute the payload; the temporary Bun directory is deleted afterwards (Elastic Security Labs, 2026-08-06). The payload is cross-platform across Linux, macOS and Windows, and is heavily obfuscated at 711 kilobytes using control-flow flattening (Elastic Security Labs, 2026-08-06). It appears under two filenames — one in packages compromised directly from the keyv monorepo, another in packages trojanised during worm propagation — which share the same hash, so the filename indicates which generation of the infection a defender is looking at (Elastic Security Labs, 2026-08-06).

A second infection route that does not involve installing anything. In Visual Studio Code a folderOpen task under tasks.json runs the dropper when an infected repository is merely opened, and where the stolen credential set includes a GitHub App token the worm commits malicious hooks to up to 50 branches per accessible repository, injecting both a .claude/settings.json and a .vscode/tasks.json into each — so a developer can be infected by opening the repository (Elastic Security Labs, 2026-08-06). That is the operationally important departure: an organisation that responds to a supply-chain wave purely by pinning or freezing dependency installs has not closed the path that fires when an engineer clones and opens the repository, and the AI-assistant configuration file is a trust surface most repository review does not read.

Collection and exfiltration. A collector component scans over 300 unique patterns across credential stores on a developer machine, with notable targeting of AI-tooling credentials for Anthropic, Claude, Codex, Cursor, OpenAI and Gemini, alongside AWS, GCP, Azure and Alibaba Cloud credentials, GitHub personal-access tokens, JWTs and session tokens, HashiCorp Vault tokens, SSH private keys, Kubernetes service-account tokens and npm tokens (Elastic Security Labs, 2026-08-06). Harvested material is gzip-compressed, encrypted under a randomly generated AES-256-GCM key, and that key is in turn RSA-encrypted to the attacker's hardcoded public key (Elastic Security Labs, 2026-08-06). For delivery, CHAINDROP does not hardcode a command-and-control domain: it queries an Ethereum smart contract at runtime to retrieve the current exfiltration endpoint, using multiple RPC providers as fallbacks, so the operator can rotate infrastructure by updating the contract rather than by shipping a new payload (Elastic Security Labs, 2026-08-06). If that path and its successor fail, it falls back to exfiltrating through a public GitHub repository created under the victim's own account with a fixed Shai-Hulud description string (Elastic Security Labs, 2026-08-06).

A containment-sequencing warning the two reports do not agree on. OX Security states the malware carries a dead man's switch that deletes the current machine if the stolen GitHub token is revoked (OX Security, 2026-08-04). Elastic's own guidance is to revoke all GitHub tokens for impacted machines and does not mention any such trigger (Elastic Security Labs, 2026-08-06). Only one vendor reports it and the other does not corroborate it, so treat it as an unconfirmed claim from a first-hand analysis rather than an established property — but sequence around it, because the cost of being wrong is asymmetric. Isolating and imaging a suspected host before revoking its GitHub token loses nothing if the switch does not exist, while revoking first loses the host and its evidence if it does.

Propagation gate. The worm activates only when the credential sweep turns up an npm token meeting two conditions together: package-write permission, and the ability to publish without two-factor authentication (Elastic Security Labs, 2026-08-06). Given a qualifying token it enumerates every package the victim can publish to, downloads each latest tarball from the registry, and republishes it trojanised (Elastic Security Labs, 2026-08-06). That gate is the single most useful fact in the report for a defender, because it converts an unbounded ecosystem-wide risk into a property you can audit on your own accounts.

Triage: developer and CI hosts legitimately run script interpreters from package-manager parents on every build, and legitimately download toolchains, so neither alone discriminates. The separating features are that the runtime is fetched mid-install rather than during provisioning and its directory is removed immediately afterwards; that the process reads credential stores belonging to unrelated tools — cloud CLIs, SSH, Kubernetes, AI assistants — in one burst, which no ordinary build step does; and that outbound blockchain RPC follows the credential reads in the same process tree. Any one of these is weak on its own; the sequence is the signal.